A keyless remote start system is a system for unlocking a vehicle without actively using a car key (so called passive vehicle unlock) and starting it by merely actuating a starting knob. For this purpose, a user only needs to carry a radio key or electronic vehicle key. If only a passive vehicle unlocking is possible, this is called keyless entry.
When the user approaches the vehicle or, e.g., touches a door handle of the vehicle, a device installed in the vehicle is woken up and sends a radio signal to the radio key with a first frequency in the range of between 30 and 300 kHz, which contains a coded enquiry signal. The radio key decodes the enquiry signal, provides it with new coding and sends it out again as a response signal at a second frequency located in the UHF range as illustrated in FIG. 1. The device installed in the vehicle knows the coding arrangement of the radio key, and, if a response signal corresponds to a response signal to be expected, the vehicle is unlocked. The range of the radio signal having the first lower frequency is restricted to a few meters so that the device at the vehicle can normally be woken up only by a radio key located close to the vehicle.
A range extension or a relay station attack (hereinafter “RSA”) primarily extends the range of the radio signal having the lower frequency using two relay stations, a first one in the vicinity of the vehicle door and a second one in the vicinity of a person who carries the radio key, as will be described in FIG. 2 that follows.
An attacker who carries the first relay station wakes up the device at the vehicle, e.g. by touching the door handle so that the latter sends the radio signal having the lower frequency. This is received by the first relay station and sent by the latter at a quite different frequency to the second relay station, which converts the radio signal again into the original radio signal having the lower frequency and sends it to the radio key. The response signal of the radio key is normally strong enough to bridge a distance back to the vehicle and opens the vehicle (so-called “small variant of the RSA”). If the response signal of the radio key is not strong enough, the relay stations can provide a return channel that extends a range of the radio signal having the higher frequency (so-called “large variant of the RSA”).
A passive vehicle start is triggered independently of the passive vehicle unlocking in the prior art if the key is recognized as being located in the vehicle, e.g. by a further near-field communication within the passenger space, and a starting button on the dashboard is pushed. Therefore, this function can also be triggered by an RSA when a thief has entered the vehicle, whether by RSA or by breaking in, and the thief can drive the vehicle away.